Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent image-analysis skill, but users should know intended images are sent to an external Gemini/NUWA vision service through a local helper script not included in the package.
Install only if you are comfortable having selected local images analyzed by the referenced external vision service, and avoid using it on screenshots, receipts, documents, or photos that contain sensitive information unless that disclosure is acceptable. Also verify the local vision-tool.py script separately, because it is outside this reviewed package.
The trigger condition says the skill should activate when the user sends any image file or uses a very broad phrase. That can cause unintended invocation on unrelated uploads, expanding access to user-provided local image paths and sending image contents to an external vision API without sufficiently clear user intent.
The keyword list includes generic terms like screenshot, image, identify, and describe image, which are common in normal conversation and can match out of context. This increases the chance of accidental tool execution and unintended disclosure of sensitive visual data to the downstream Gemini/NUWA service.
No suspicious patterns detected.
